Mikrotik CCR als KPN IPTV IGMP router plots freeze

woensdag 3 oktober 2018 11:34

Acties:

0 Henk 'm!

Topicstarter

Ik heb volgens de instructies op netwerkje.com mijn CCR ingericht voor IPTV routing van KPN zodat ik de Experiabox met veel liefde een trap uit de meterkast kon geven.

Dit heeft maandenlang prima gewerkt en ik was blij met de oplossing. Sinds enkele dagen kunnen we echter geen tv meer kijken. Het beeld bevriest bij elke zender na 2 seconde. Als ik het goed begrijp is er dan iets aan de hand met de IGMP proxy...maar daar is weinig aan veranderd. Enige dat ik kan bedenken is dat RouterOS een update heeft gehad en er iets is gewijzigd aan de inner-workings. Maar dan had ik van meer mensen alarmsignalen verwacht gehoord te hebben.

Inrichting in het kort:
- CCR via Ether-0 (WAN) aangesloten op NTU kastje
- bridge-lan bevat alle ethernet poorten minus WAN en heeft IGMP snooping enabled staan
- onder de WAN-ether zijn twee VLANs aangemaakt: vlan4 (iptv) en vlan6 (internet)
- de betreffende DHCP opties zijn opgesteld voor de client en server - zowel de CCR als de decoder ontvangt succesvol een IP (decoder: 192.168.10.8, vlan4: 10.230.157.181/22)
- IGMP Proxy ingesteld met downstream op bridge-lan, upstream op 10.142.64.0/18 en 213.75.0.0/16.
- masquerading toegepast op vlan4 voor deze beide ip ranges

Als ik debug logging aanzet op de igmp proxy zie ik regels als:
"Ignoring request from unknown address - "Alternative subnets" configuration may be required"
"Source=192.168.10.8"
"Destination=239.255.255.250"

Geen idee of dat er iets mee te maken heeft.

Tot slot mijn config:

code:

# oct/03/2018 11:26:25 by RouterOS 6.43.2
# software id = 7P09-2CFT
#
# model = CCR1009-7G-1C-1S+
# serial number = 7AF1075B84A2
/interface bridge
add arp=proxy-arp fast-forward=no igmp-snooping=yes name=bridge-lan \
    protocol-mode=none
/interface ethernet
set [ find default-name=combo1 ] arp=proxy-arp combo-mode=copper name=\
    combo1-WAN
set [ find default-name=ether1 ] speed=100Mbps
set [ find default-name=ether2 ] speed=100Mbps
set [ find default-name=ether3 ] speed=100Mbps
set [ find default-name=ether4 ] speed=100Mbps
set [ find default-name=ether5 ] speed=100Mbps
set [ find default-name=ether6 ] speed=100Mbps
set [ find default-name=ether7 ] speed=100Mbps
set [ find default-name=sfp-sfpplus1 ] advertise=\
    10M-full,100M-full,1000M-full disabled=yes
/interface pptp-client
add connect-to=israel.privateinternetaccess.com name=pptp-PIA user=
/interface vlan
add arp=proxy-arp interface=combo1-WAN name=vlan4-iptv vlan-id=4
add interface=combo1-WAN name=vlan6-internet vlan-id=6
/interface pppoe-client
add add-default-route=yes allow=pap,mschap2 default-route-distance=0 \
    disabled=no interface=vlan6-internet keepalive-timeout=20 max-mru=1480 \
    max-mtu=1480 name=pppoe-KPN user=
/interface list
add name=LAN
add name=WAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip dhcp-client option
add code=60 name=option60-vendorclass value="'IPTV_RG'"
/ip dhcp-server option
add code=60 name=option60-vendorclass value="'IPTV_RG'"
add code=28 name=option28-broadcast value="'192.168.10.255'"
/ip dhcp-server option sets
add name=IPTV options=option60-vendorclass,option28-broadcast
/ip ipsec peer profile
add enc-algorithm=aes-192,aes-128,3des name=profile_1
/ip ipsec proposal
set [ find default=yes ] enc-algorithms=aes-256-cbc,3des pfs-group=none
/ip pool
add name=dhcp-pool1 ranges=192.168.10.20-192.168.11.199
add name=l2tp-pool ranges=192.168.11.200-192.168.11.254
/ip dhcp-server
add address-pool=dhcp-pool1 authoritative=after-2sec-delay disabled=no \
    interface=bridge-lan name=dhcp1
/ip ipsec mode-config
add address-pool=l2tp-pool name=cfg1 system-dns=no
/ppp profile
add change-tcp-mss=yes name=openVpn-client only-one=yes use-compression=no \
    use-encryption=required use-mpls=no use-upnp=no
add local-address=dhcp-pool1 name=default-l2tp remote-address=l2tp-pool
/interface ovpn-client
/routing bgp instance
set default disabled=yes
/snmp community
set [ find default=yes ] addresses=0.0.0.0/0
/interface bridge port
add bridge=bridge-lan hw=no interface=ether1
add bridge=bridge-lan hw=no interface=ether2
add bridge=bridge-lan hw=no interface=ether3
add bridge=bridge-lan hw=no interface=ether4
add bridge=bridge-lan hw=no interface=ether5
add bridge=bridge-lan hw=no interface=ether6
add bridge=bridge-lan hw=no interface=ether7
add bridge=bridge-lan hw=no interface=sfp-sfpplus1
/ip neighbor discovery-settings
set discover-interface-list=all
/interface l2tp-server server
set authentication=mschap2 default-profile=default-l2tp enabled=yes
/interface list member
add interface=bridge-lan list=LAN
add interface=combo1-WAN list=WAN
add interface=pppoe-KPN list=WAN
add interface=vlan4-iptv list=WAN
add interface=vlan6-internet list=WAN
/ip address
add address=192.168.10.1/23 comment=defconf interface=bridge-lan network=\
    192.168.10.0
/ip dhcp-client
add comment="uitgezet op combo1-WAN ivm directe koppeling zonder Experiabox. d\
    hcp zit nu op ppoe-verbinding" dhcp-options=hostname,clientid interface=\
    combo1-WAN use-peer-dns=no
add add-default-route=special-classless default-route-distance=254 \
    dhcp-options=option60-vendorclass,hostname,clientid disabled=no \
    interface=vlan4-iptv use-peer-dns=no use-peer-ntp=no
/ip dhcp-server lease
add address=192.168.10.8 comment="KPN TV Decoder Woonkamer" dhcp-option-set=\
    IPTV mac-address=00:02:9B:DF:1F:F2 server=dhcp1
/ip dhcp-server network
add address=192.168.10.0/23 dns-server=192.168.10.1 gateway=192.168.10.1 \
    ntp-server=192.168.10.1
/ip dns
set allow-remote-requests=yes cache-size=8192KiB servers=\
    1.1.1.1,8.8.4.4,8.8.8.8
/ip firewall address-list
add address=192.168.10.0/23 list=LAN
/ip firewall filter
add action=accept chain=input comment=IpSec dst-port=500,1701,4500 \
    in-interface-list=WAN protocol=udp
add action=accept chain=input comment=IpSec protocol=ipsec-esp
add action=accept chain=input comment="IpSec Authentication" protocol=\
    ipsec-ah
add action=accept chain=input comment="IPTV Multicast" in-interface=\
    vlan4-iptv protocol=igmp src-address=224.0.0.0/8
add action=accept chain=forward comment="IPTV Multicast" in-interface=\
    vlan4-iptv protocol=udp src-address=224.0.0.0/8
add action=accept chain=forward comment="IPTV Multicast" in-interface=\
    vlan4-iptv protocol=udp src-address=224.0.0.0/8
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
    connection-state=established,related routing-mark=!PPTP-VPN
add action=accept chain=input comment=\
    "defconf: Accept established, related, untracked" connection-state=\
    established,related,untracked
add action=accept chain=input comment="Accept all from LAN" \
    in-interface-list=LAN
add action=drop chain=input comment="Disable outside DNS requests" \
    connection-state=new dst-port=53 in-interface=pppoe-KPN protocol=tcp
add action=drop chain=input comment="Disable outside DNS or NTP requests" \
    connection-state=new dst-port=53,123 in-interface=pppoe-KPN protocol=udp
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=reject chain=input comment="Protect against KPN block" \
    in-interface=pppoe-KPN protocol=udp reject-with=icmp-port-unreachable
add action=reject chain=input comment="Protect against KPN block" \
    in-interface=pppoe-KPN protocol=tcp reject-with=icmp-port-unreachable
add action=add-src-to-address-list address-list=winbox_stage1 \
    address-list-timeout=1m chain=input comment=\
    "Winbox blacklist add to stage 1" connection-state=new dst-port=8291 \
    in-interface-list=WAN protocol=tcp src-address-list=""
add action=add-src-to-address-list address-list=winbox_stage2 \
    address-list-timeout=1m chain=input comment=\
    "Winbox bruteforce add to stage 2" connection-state=new dst-port=8291 \
    protocol=tcp src-address-list=winbox_stage1
add action=add-src-to-address-list address-list=winbox_stage3 \
    address-list-timeout=1m chain=input comment=\
    "Winbox brute force- add to stage 3" connection-state=new dst-port=8291 \
    protocol=tcp src-address-list=winbox_stage2
add action=add-src-to-address-list address-list=winbox_blacklist \
    address-list-timeout=1w3d chain=input comment=\
    "Winbox bruteforce add to blacklist" connection-state=new dst-port=8291 \
    protocol=tcp src-address-list=winbox_stage3
add action=drop chain=input comment="Drop winbox brute forcers" dst-port=8291 \
    protocol=tcp src-address-list=winbox_blacklist
add action=drop chain=input comment="Drop all remaining WAN connections" \
    in-interface-list=WAN
add action=accept chain=forward comment=\
    "defconf: accept related, established, untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment="Drop all WAN not DST NATted" \
    connection-nat-state=!dstnat connection-state=new in-interface-list=WAN
/ip firewall nat
add action=redirect chain=dstnat comment=\
    "FORCE DNS TO LOCAL MIKROTIK DNS SERVER" dst-port=53 in-interface-list=\
    LAN protocol=udp to-ports=53
add action=redirect chain=dstnat comment=\
    "FORCE DNS TCP TO LOCAL MIKROTIK DNS SERVER" dst-port=53 \
    in-interface-list=LAN protocol=tcp to-ports=53

add action=masquerade chain=srcnat comment="Masquerade iptv" dst-address=\
    10.142.64.0/18 out-interface=vlan4-iptv
add action=masquerade chain=srcnat comment="Masquerade iptv" dst-address=\
    213.75.0.0/16 out-interface=vlan4-iptv
add action=masquerade chain=srcnat out-interface=pppoe-KPN
/ip firewall service-port
set ftp disabled=yes
set tftp disabled=yes
set irc disabled=yes
set sip disabled=yes
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes
set ssh disabled=yes
set api disabled=yes
set api-ssl disabled=yes
/routing igmp-proxy
set quick-leave=yes
/routing igmp-proxy interface
add alternative-subnets=10.142.64.0/18,213.75.0.0/16 interface=vlan4-iptv \
    upstream=yes
add interface=bridge-lan
/system clock
set time-zone-name=Europe/Amsterdam
/system logging
add disabled=yes prefix="L2TPDBG===>" topics=l2tp
add disabled=yes prefix="IPSECDBG===>" topics=ipsec
add topics=igmp-proxy
/system ntp client
set enabled=yes primary-ntp=147.251.48.140 secondary-ntp=193.150.34.2
/system ntp server
set enabled=yes
/system routerboard settings
# Warning: cpu not running at default frequency
set cpu-frequency=600MHz silent-boot=no

Iemand misschien een helder idee van wat hier aan de hand is?

Zeg wat je doet en doe wat je zegt, dan wordt de hele wereld een stukje leuker

woensdag 3 oktober 2018 15:02